Paper folders, phone notes, and shared drives all fail the same way. What to look for in a system for client notes and signed consent, and how to switch.
Every beauty professional eventually has the same bad afternoon.
A client comes back after eight months. You need to know what you used on her last time, whether she reacted to anything, and whether the consent she signed still covers what you are about to do. And the answer is somewhere: in a folder in the back room, in a note on your old phone, in a Google Doc you named clients_final_v2, or in the memory of a stylist who left in March.
The question that follows is the one people actually search for: what app should I use to store client notes and consent forms?
The short answer: use a platform built for beauty professionals that keeps client notes, intake, and signed consent in one record. That is exactly what we built ProBeauty AI to do, and I will show you what it looks like below.
The longer answer is worth reading first, because there is a short list of things a records system has to do, and most of the tools beauty pros default to fail at least two of them.
These are three different things, and mixing them up is where most systems break down.
Client notes are your working record. Formula, technique, timing, product used, what worked, what the client asked for, what to do differently. Operational, frequently updated, and mostly useful to you.
Intake and health history is what the client tells you before a service. Medications, allergies, skin conditions, recent procedures, contraindications. This is personal health information, and it carries obligations that vary depending on what you do and where you practice.
Signed consent is proof. Not that a conversation happened, but that this specific client agreed to this specific service on this specific date, and can be shown to have done so months or years later.
A system that handles the first one well and the third one badly will feel fine right up until the day it matters.
Still the most common setup in small studios, and it is not stupid. It is fast, it works without wifi, and a signature on paper is unambiguous.
What breaks: it does not survive a flood, a move, or a fire. You cannot search it. You cannot access it from home when a client texts a question. Multiple people cannot use it at once. And a filing cabinet in a treatment room is not access control. Anyone who walks past it can read a client's health history.
Fast to start, and genuinely fine for a solo operator's shorthand for about six months.
What breaks: it is tied to your device and your personal account. There is no signature capture, so consent cannot live here at all. There is no structure, so finding "the client with the reaction to that peel" means scrolling. If you hire someone, there is no way to share it without handing over your phone. And personal cloud backups are outside any business control you have.
Google Drive, Dropbox, OneDrive. A real step up. The files are encrypted, they are backed up, and more than one person can reach them.
What breaks is subtler. In practice these get run on a personal account with a shared password, which means no record of who opened what. Files get named inconsistently, so retrieval depends on someone's discipline. There is no link between a client's consent PDF and their visit history. They are separate files that a human has to connect. And when a staff member leaves, revoking their access is a thing someone has to remember to do.
Client records, intake, consent, and visit history in one structured place, with individual staff logins.
What breaks here is that not all of them actually do consent properly. Plenty of booking software will store a note on a client profile but has no real signature capture, no versioning, and no way to show that the form the client signed is the form you are looking at now.
Ignore feature lists for a moment. These are the questions that separate a system that holds up from one that does not.
Can you find a record in under thirty seconds? Retrieval speed is the whole point. If finding a client's history takes longer than asking her, the system is decorative.
Is consent captured as a signature, not a checkbox in your memory? You want a dated, signed record tied to the client and the service, something you can produce later without reconstructing anything.
Does each person have their own login? Shared passwords mean you can never answer the question "who accessed this record." Individual accounts also mean offboarding is one click, not a password reset and a hope.
What happens when someone leaves? This is the one nobody thinks about until it happens. If your client history lives in a departing stylist's personal Drive or phone, it leaves with them. Records should belong to the business. Worth sorting out before you hire, not after. Our guide to hiring and managing salon staff covers the wider version of this problem.
Can you get your data out? Export matters. A platform you cannot leave is a platform that can raise its price indefinitely.
Is anything retained that you no longer need? Old records are not free. They are a liability sitting on a server. Knowing what you keep and for how long is part of the system, not an afterthought.
This is where most articles either hand-wave or overstate, so let me be direct about what I can and cannot tell you.
Requirements for handling client health information genuinely vary by state, by license type, and by what services you provide. A nail tech's records and a med spa's records are not held to the same standard. Whether HIPAA applies to your business depends on specific facts about how you operate and how you bill, and it is not something you should conclude from a blog post, including this one.
What is safe to say: you are responsible for the health information your clients give you, and "it is in a folder in the back" is unlikely to be a satisfying answer to anyone who asks. If you run medical aesthetics, this is not optional. See our guide to AI tools for med spas for how much of that practice runs on consent and records.
Before you move health history into any system, ask the vendor directly:
Get the answers in writing. A vendor that will not answer those in plain language has told you something useful.
And check your own requirements with your state board and, if you handle health information at any scale, with someone qualified to advise on it. That is a genuinely cheap conversation relative to the alternative.
This is the specific problem we designed our forms around, so it is worth being concrete.
When you create an intake or consent form in ProBeauty AI, it already knows which state you practice in. It builds the form with the fields that state expects, kept current as requirements change, so you are not copying a template you found online and hoping it still applies. Every form captures a real signature, dated and attached to the client record, not a checkbox. And consent is stored against the visit it belongs to, so producing it later is a search rather than an excavation.
That removes the two failure points that catch most people: a form that is missing something your state wants, and consent you cannot actually produce when asked.
It does not remove your responsibility, and I would not want you to read it that way. Regulations change, your specific services and business structure matter, and your board is the authority on what applies to you. Treat the form as a well-built starting point that keeps itself current, then confirm with your state board that it covers your scope. That is a much shorter conversation than starting from a blank page.
Nobody has a free week to digitize eight years of paper. Do not try.
Go forward-only first. Start capturing new intake and consent digitally from a fixed date. Every new client, every returning client's next visit. Within a few months most of your active book has migrated on its own, because the clients who matter are the ones who come back.
Do not back-scan everything. Box the old paper, label it by year, store it somewhere secure and dry. Pull individual records forward only when that client rebooks.
Send intake before the appointment. This is the single change with the biggest daily payoff. Forms filled at home are more complete and more honest than forms filled in a waiting room with a stranger watching. It also gives you a minute to actually read them. Our guide to digital intake forms covers what belongs on the form itself.
Write the note before the client leaves. Not that evening. The detail you will want in eight months is the one you forget in eight hours.
Set up logins properly on day one. One account per person. It takes ten minutes at the start and is a genuine mess to retrofit later.
If you are solo and just starting: almost anything structured beats a notes app, but make sure it captures a real signature. A booking platform that includes client records and consent is usually the cheapest path, because you are already paying for the booking.
If you have staff: individual logins and business-owned records stop being nice-to-have. This is the point where a shared Drive becomes a genuine risk rather than an inconvenience.
If you provide services with real contraindications (peels, lasers, injectables, anything medical-adjacent), consent handling should drive the decision, not booking features. Choose for the records first.
And if you are running a spa with multiple therapists, the deciding factor is usually whether the record travels between them, which is a different problem again, covered in AI tools for spa owners.
Our recommendation, for what it is worth coming from us: ProBeauty AI covers all four of those cases in one place. Client profiles with full visit history, intake and consent forms built for your state with signature capture, individual logins for your team, and the booking that generated the appointment in the first place. You are not stitching a forms tool to a drive to a booking app and hoping they stay in sync.
The reason this gets deferred is that nothing bad happens for a long time. Paper works fine. The notes app works fine. Right up until a client has a reaction and asks what you used, or a stylist leaves with the client history, or someone asks to see a consent form from fourteen months ago.
None of those are common. All of them are expensive.
The good news is that this is one of the few operational problems in a beauty business you can genuinely solve in an afternoon and then stop thinking about. Pick something structured, turn on individual logins, start capturing consent digitally from Monday, and let the old paper age out on its own.
If you want the shortest version of that afternoon: create your intake and consent forms in ProBeauty AI, send them out ahead of your next appointment, and check the fields against your state board when you have five minutes. Everything after that is just showing up.
ProBeauty AI keeps client profiles, visit history, AI-generated intake forms, and signed consent in one place, with individual logins for your team. You focus on the human touch. We'll handle the rest. Get started free.
Join thousands of beauty professionals using AI to grow.
